Automate mobile management tasks with rules

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  Rules.
3. Click Device management rules.
4. Click Add Rule and choose an option:
   • To use a rule template, click Rule from template and then click the template. For details, see Use the rule templates.
   • To build your own rule, click New rule.
5. Enter or edit the rule title and description.
6. Choose who the rule applies to. By default, the rule applies to everyone in your organization.
   • To apply the rule to only select users, click Specify organizational units or groups and select the organizational units and groups to include.
   • To exclude users in specific groups, first select at least one organizational unit or group to include. Then click Exclude groups and select the group to exclude. Repeat to exclude more groups.

   For example, to apply a rule to everyone in your organization except for one group, include the top-level organizational unit and exclude the one exempt group.

   To remove an organizational unit or group, click Clear  next to it.

7. Click Continue.
8. If necessary, select the event that triggers the rule. For details, see Choose a trigger and conditions.
9. Click Add Condition and set a device type condition:
   1. Click Field and select Device type.
   2. Click Value and select the device type: All devices, Android, or iOS. Not all device type options may be available because some events are supported for only certain types.

   Note: A device type condition is required before you can go on to the next step.

10. (Optional) Click Add Condition and set up more conditions. A device must meet all conditions for the rule to apply.
11. Click Continue.
12. If necessary, select the action to take when the rule's conditions are met. Not all actions are available for all events.
    • Block mobile device—Stops the device from syncing corporate data.
    • Approve mobile device—(advanced mobile management only) Allows the device to sync corporate data.
    • Perform wipe—Wipes the user’s corporate account and associated data from the device. Learn more about account wipes.
    • No action—Take no action on the device. You can use this option when you only want to get a notification that the event occurred (described in the next steps).
13. (Optional) To send email notifications to all super administrators, check the Send to alert center box and then check the All super administrators box. Note: Alert center notification aren't yet supported, but must be turned on to send emails to super administrators.
14. Click Continue.
15. Review the rule settings. If they're correct, click Finish. If not, click Back to edit the rule.
16. In the dialog that opens, choose an option:
    • To create the rule and turn it on now, click Active.
    • To create the rule and turn it on later, click Inactive.
17. Click Complete.
18. To turn on an inactive rule, in the rules list, click the rule. At the left, click the menu and select Active.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  Rules.
3. Click Device management rules.
4. Click the rule you want to edit.
5. Click the section you want to edit and make your changes. Click Continue as needed to progress to the review page.
6. Review the rule settings. If they're correct, click Finish. If not, click Back to edit the rule.
7. In the dialog that opens, choose whether the rule is active or inactive.
8. Click Complete.

This rule blocks an Android device when there are more than 5 failed attempts to unlock it. The rule stops the user's work or school data from synchronizing to the device.

This rule removes corporate data from an Android device, iPhone, or iPad when suspicious activity is detected.

For iPhones and iPads, the account is wiped when the device’s Wi-Fi MAC address changes.

For Android devices, the device is wiped when any of the following device properties change:

For company-owned Android devices and personal devices set up as work only, all data is wiped from the device and the device is factory reset. For personal devices with a work profile, only the work profile is wiped, leaving personal data untouched.

For more about how account and device wipe works, see Remove corporate data from a device.

Automatically approves all supported devices when a user enrolls their device for management. Corporate data will synchronize to the device when the user signs in with their account.

The rule is triggered when the account registration state of a device in your organization changes. The registration state can change when:

• A user adds their managed work or school account on a new device.
• A user unregisters their managed work or school account from a managed device.
• The management privilege your organization has on an Android device changes.

By default, the rule is triggered when any of these events are detected.

To apply the rule to only certain devices, you can set conditions based on device properties and the following event-specific options:

The rule is triggered when user access to work or school data changes. These events include:

• A device is approved, blocked, or wiped
• The managed account is wiped, signed out by an admin, or unenrolled

By default, the rule is triggered when any device action event occurs.

To apply the rule to only certain devices, you can set conditions based on device properties and the following event-specific options:

For example, to block a device when a device wipe isn't successful:

1. Set Type of action taken on a device to Device wipe.
2. Set Status of an action taken on a device to Failed.

The rule is triggered whenever a user installs, uninstalls, or updates an app on their device. For personal Android devices that don’t have a work profile, the Application Auditing setting needs to be turned on. For iPhones and iPads, only changes to managed apps installed using the Google Device Policy app are detected.

To apply the rule to only certain devices, you can set conditions based on device properties and the following event-specific options:

The rule is triggered when a device becomes noncompliant with your organization's’ policies. For example, a user changes their device password and it no longer complies with your password policy. For details, see Device compliance status.

To apply the rule to only certain devices, you can set conditions based on device properties and the following event-specific options:

The rule is triggered when an Android device becomes compromised or is no longer compromised. An Android device is compromised when it’s rooted—a process that removes restrictions on a device. Compromised devices can indicate a potential security threat.

To apply the rule to only certain devices, you can set conditions based on device properties and the following event-specific options:

The rule is triggered when a device’s operating system (OS) changes. The types of OS changes that trigger the rule depend on the device type:

• Android—Changes to the OS version, build number, kernel version, baseband version, security patch, or bootloader version.
• iOS—Only changes to the OS version and build number. For example, a user updates their device to a new OS or applies the latest security patch.

To apply the rule to only certain devices, you can set conditions based on device properties and the following event-specific options:

The rule is triggered when the ownership of a device changes from personal to company-owned, or from company-owned to personal.

To apply the rule to only certain devices, you can set conditions based on device properties and the following event-specific options:

The rule is triggered when device settings change on Android devices, such as USB debugging, unknown sources, developer options, or verify apps.

To apply the rule to only certain devices, you can set conditions based on device properties and the following event-specific options:

The rule is triggered when a user's account syncs on a device.

To apply the rule to only certain devices, you can set conditions based on device properties and the following event-specific options:

The rule is triggered when a device reaches a set number of failed attempts to unlock it. By default, the rule is applied when there are more than 5 failed attempts.

To change the number of failed attempts before the rule is applied, use this option:

The rule is triggered when a device property changes on a managed device and that property isn't one that usually changes. For example, the device model changes when the device hasn’t changed.

For Android devices, suspicious activity includes changes to the following device properties:

For iPhones and iPads, it only includes changes to the Wi-Fi MAC address.

To apply the rule to only certain devices, you can set conditions based on device properties and the following event-specific options:

Applies the rule when an Android device starts supporting work profiles. For example, when the OS version is upgraded and the device now supports work profiles.